--- a/modules/libpr0n/src/imgContainer.cpp
+++ b/modules/libpr0n/src/imgContainer.cpp
@@ -1219,19 +1219,19 @@ imgContainer::sDiscardTimerCallback(nsIT
 
   NS_ASSERTION(aTimer == self->mDiscardTimer,
                "imgContainer::DiscardTimerCallback() got a callback for an unknown timer");
 
   self->mDiscardTimer = nsnull;
 
   int old_frame_count = self->mFrames.Count();
 
-  // Don't discard animated images, because we don't handle that very well. (See bug 414259.)
   if (self->mAnim) {
-    return;
+    delete self->mAnim;
+    self->mAnim = nsnull;
   }
 
   self->mFrames.Clear();
 
   self->mDiscarded = PR_TRUE;
 
   PR_LOG(gCompressedImageAccountingLog, PR_LOG_DEBUG,
          ("CompressedImageAccounting: discarded uncompressed image data from imgContainer %p (%s) - %d frames (cached count: %d); "

--- a/modules/libpr0n/src/imgLoader.cpp
+++ b/modules/libpr0n/src/imgLoader.cpp
@@ -250,31 +250,31 @@ imgCacheEntry::imgCacheEntry(imgRequest 
 void imgCacheEntry::TouchWithSize(PRInt32 diff)
 {
   LOG_SCOPE(gImgLog, "imgCacheEntry::TouchWithSize");
 
   mTouchedTime = SecondsFromPRTime(PR_Now());
 
   if (!Evicted()) {
     nsCOMPtr<nsIURI> uri;
-    mRequest->GetKeyURI(getter_AddRefs(uri));
+    mRequest->GetURI(getter_AddRefs(uri));
     imgLoader::CacheEntriesChanged(uri, diff);
   }
 }
 
 void imgCacheEntry::Touch(PRBool updateTime /* = PR_TRUE */)
 {
   LOG_SCOPE(gImgLog, "imgCacheEntry::Touch");
 
   if (updateTime)
     mTouchedTime = SecondsFromPRTime(PR_Now());
 
   if (!Evicted()) {
     nsCOMPtr<nsIURI> uri;
-    mRequest->GetKeyURI(getter_AddRefs(uri));
+    mRequest->GetURI(getter_AddRefs(uri));
     imgLoader::CacheEntriesChanged(uri);
   }
 }
 
 imgCacheQueue::imgCacheQueue()
  : mDirty(PR_FALSE),
    mSize(0)
 {}
@@ -904,17 +904,17 @@ PRBool imgLoader::RemoveFromCache(nsIURI
 
 PRBool imgLoader::RemoveFromCache(imgCacheEntry *entry)
 {
   LOG_STATIC_FUNC(gImgLog, "imgLoader::RemoveFromCache entry");
   PRBool ret = PR_FALSE;
   nsRefPtr<imgRequest> request(getter_AddRefs(entry->GetRequest()));
   if (request) {
     nsCOMPtr<nsIURI> key;
-    if (NS_SUCCEEDED(request->GetKeyURI(getter_AddRefs(key))) && key)
+    if (NS_SUCCEEDED(request->GetURI(getter_AddRefs(key))) && key)
       ret = RemoveFromCache(key);
   }
 
   return ret;
 }
 
 nsresult imgLoader::EvictEntries(imgCacheTable &aCacheToClear, imgCacheQueue &aQueueToClear)
 {
@@ -1056,17 +1056,17 @@ NS_IMETHODIMP imgLoader::LoadImage(nsIUR
 
     // Create a loadgroup for this new channel.  This way if the channel
     // is redirected, we'll have a way to cancel the resulting channel.
     nsCOMPtr<nsILoadGroup> loadGroup =
         do_CreateInstance(NS_LOADGROUP_CONTRACTID);
     newChannel->SetLoadGroup(loadGroup);
 
     void *cacheId = NS_GetCurrentThread();
-    request->Init(aURI, aURI, loadGroup, newChannel, entry, cacheId, aCX);
+    request->Init(aURI, loadGroup, newChannel, entry, cacheId, aCX);
 
     // create the proxy listener
     ProxyListener *pl = new ProxyListener(static_cast<nsIStreamListener *>(request.get()));
     if (!pl) {
       request->Cancel(NS_ERROR_OUT_OF_MEMORY);
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
@@ -1193,17 +1193,17 @@ NS_IMETHODIMP imgLoader::LoadImageWithCh
 
     *listener = nsnull; // give them back a null nsIStreamListener
   } else {
     NewRequestAndEntry(uri, getter_AddRefs(request), getter_AddRefs(entry));
 
     // We use originalURI here to fulfil the imgIRequest contract on GetURI.
     nsCOMPtr<nsIURI> originalURI;
     channel->GetOriginalURI(getter_AddRefs(originalURI));
-    request->Init(originalURI, uri, channel, channel, entry, NS_GetCurrentThread(), aCX);
+    request->Init(originalURI, channel, channel, entry, NS_GetCurrentThread(), aCX);
 
     ProxyListener *pl = new ProxyListener(static_cast<nsIStreamListener *>(request.get()));
     if (!pl)
       return NS_ERROR_OUT_OF_MEMORY;
 
     NS_ADDREF(pl);
 
     *listener = static_cast<nsIStreamListener*>(pl);
@@ -1466,17 +1466,17 @@ NS_IMETHODIMP imgCacheValidator::OnStart
   imgRequest *request;
 
   if (!NewRequestAndEntry(uri, &request, getter_AddRefs(entry)))
       return NS_ERROR_OUT_OF_MEMORY;
 
   // We use originalURI here to fulfil the imgIRequest contract on GetURI.
   nsCOMPtr<nsIURI> originalURI;
   channel->GetOriginalURI(getter_AddRefs(originalURI));
-  request->Init(originalURI, uri, channel, channel, entry, NS_GetCurrentThread(), mContext);
+  request->Init(originalURI, channel, channel, entry, NS_GetCurrentThread(), mContext);
 
   ProxyListener *pl = new ProxyListener(static_cast<nsIStreamListener *>(request));
   if (!pl) {
     NS_RELEASE(request);
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   mDestListener = static_cast<nsIStreamListener*>(pl);

--- a/modules/libpr0n/src/imgRequest.cpp
+++ b/modules/libpr0n/src/imgRequest.cpp
@@ -91,17 +91,16 @@ imgRequest::imgRequest() :
 }
 
 imgRequest::~imgRequest()
 {
   /* destructor code */
 }
 
 nsresult imgRequest::Init(nsIURI *aURI,
-                          nsIURI *aKeyURI,
                           nsIRequest *aRequest,
                           nsIChannel *aChannel,
                           imgCacheEntry *aCacheEntry,
                           void *aCacheId,
                           void *aLoadId)
 {
   LOG_FUNC(gImgLog, "imgRequest::Init");
 
@@ -110,17 +109,16 @@ nsresult imgRequest::Init(nsIURI *aURI,
   NS_ASSERTION(aRequest, "No request");
   NS_ASSERTION(aChannel, "No channel");
 
   mProperties = do_CreateInstance("@mozilla.org/properties;1");
   if (!mProperties)
     return NS_ERROR_OUT_OF_MEMORY;
 
   mURI = aURI;
-  mKeyURI = aKeyURI;
   mRequest = aRequest;
   mChannel = aChannel;
   mChannel->GetNotificationCallbacks(getter_AddRefs(mPrevChannelSink));
 
   NS_ASSERTION(mPrevChannelSink != this,
                "Initializing with a channel that already calls back to us!");
 
   mChannel->SetNotificationCallbacks(this);
@@ -320,29 +318,16 @@ nsresult imgRequest::GetURI(nsIURI **aUR
     *aURI = mURI;
     NS_ADDREF(*aURI);
     return NS_OK;
   }
 
   return NS_ERROR_FAILURE;
 }
 
-nsresult imgRequest::GetKeyURI(nsIURI **aKeyURI)
-{
-  LOG_FUNC(gImgLog, "imgRequest::GetKeyURI");
-
-  if (mKeyURI) {
-    *aKeyURI = mKeyURI;
-    NS_ADDREF(*aKeyURI);
-    return NS_OK;
-  }
-
-  return NS_ERROR_FAILURE;
-}
-
 nsresult imgRequest::GetPrincipal(nsIPrincipal **aPrincipal)
 {
   LOG_FUNC(gImgLog, "imgRequest::GetPrincipal");
 
   if (mPrincipal) {
     NS_ADDREF(*aPrincipal = mPrincipal);
     return NS_OK;
   }
@@ -1021,16 +1006,17 @@ imgRequest::OnChannelRedirect(nsIChannel
     if (NS_FAILED(rv))
       return rv;
   }
 
   RemoveFromCache();
 
   mChannel = newChannel;
 
-  newChannel->GetOriginalURI(getter_AddRefs(mKeyURI));
+  nsCOMPtr<nsIURI> uri;
+  newChannel->GetOriginalURI(getter_AddRefs(uri));
 
   // If we don't still have a cache entry, we don't want to refresh the cache.
-  if (mKeyURI && mCacheEntry)
-    imgLoader::PutIntoCache(mKeyURI, mCacheEntry);
+  if (uri && mCacheEntry)
+    imgLoader::PutIntoCache(uri, mCacheEntry);
 
   return rv;
 }

--- a/modules/libpr0n/src/imgRequest.h
+++ b/modules/libpr0n/src/imgRequest.h
@@ -84,17 +84,16 @@ class imgRequest : public imgILoad,
 {
 public:
   imgRequest();
   virtual ~imgRequest();
 
   NS_DECL_ISUPPORTS
 
   nsresult Init(nsIURI *aURI,
-                nsIURI *aKeyURI,
                 nsIRequest *aRequest,
                 nsIChannel *aChannel,
                 imgCacheEntry *aCacheEntry,
                 void *aCacheId,
                 void *aLoadId);
 
   // Callers must call NotifyProxyListener later.
   nsresult AddProxy(imgRequestProxy *proxy);
@@ -123,17 +122,16 @@ private:
   inline void SetLoadId(void *aLoadId) {
     mLoadId = aLoadId;
     mLoadTime = PR_Now();
   }
   inline PRUint32 GetImageStatus() const { return mImageStatus; }
   inline nsresult GetResultFromImageStatus(PRUint32 aStatus) const;
   void Cancel(nsresult aStatus);
   nsresult GetURI(nsIURI **aURI);
-  nsresult GetKeyURI(nsIURI **aURI);
   nsresult GetPrincipal(nsIPrincipal **aPrincipal);
   nsresult GetSecurityInfo(nsISupports **aSecurityInfo);
   void RemoveFromCache();
   inline const char *GetMimeType() const {
     return mContentType.get();
   }
   inline nsIProperties *Properties() {
     return mProperties;
@@ -157,20 +155,17 @@ public:
   NS_DECL_IMGICONTAINEROBSERVER
   NS_DECL_NSISTREAMLISTENER
   NS_DECL_NSIREQUESTOBSERVER
   NS_DECL_NSICHANNELEVENTSINK
   NS_DECL_NSIINTERFACEREQUESTOR
 
 private:
   nsCOMPtr<nsIRequest> mRequest;
-  // The original URI we were loaded with.
   nsCOMPtr<nsIURI> mURI;
-  // The URI we are keyed on in the cache.
-  nsCOMPtr<nsIURI> mKeyURI;
   nsCOMPtr<nsIPrincipal> mPrincipal;
   nsCOMPtr<imgIContainer> mImage;
   nsCOMPtr<imgIDecoder> mDecoder;
   nsCOMPtr<nsIProperties> mProperties;
   nsCOMPtr<nsISupports> mSecurityInfo;
   nsCOMPtr<nsIChannel> mChannel;
   nsCOMPtr<nsIInterfaceRequestor> mPrevChannelSink;